26 years ago, as a young consultant, I got into a public argument with Göran Marby, then CEO of Cygate. He wanted to productize services. I couldn’t see why anyone would. To me, every engagement was its own problem, and the value sat in the people clever enough to solve it.
Since then, I have grown several services organizations to $165M, 450 people, and 75 countries, mostly by doing what I argued against: take work that needed our most expensive people, and turn it into work that didn’t. Now I can’t understand the organizations that won’t even try.
It started two years after the Cygate argument. At a smaller VAR, a client required documented hardening, so we wrote our first playbooks. Later, building the CSI services organization, we defined process for nearly everything, including 24/7 support for telcos in the Caribbean and the South Pacific.
By 2010, the Software Engineering Institute at Carnegie Mellon had written up this maturity process for services in five levels and called it CMMI for Services (CMMI-SVC). It is dry. It comes with an appraisal industry attached. It is also the best AI maturity model I have used.1
At Accuvant in 2011, I first met CMMI for Services, and we put it to work. We went from “cowboy consulting,” each consultant delivering on their own, to team delivery: defined offerings, with QA and a PMO on every engagement.
Meanwhile, every consultancy and model vendor has published an AI maturity model of its own. Many have five levels. (I wonder where they got that.) Read enough of them and you notice they describe the journey my delivery teams made for years, with new vocabulary and a subscription fee.
The move every services business already makes
In a services business, new work arrives messy. Nobody has delivered this exact engagement before, so you staff it with your best architect and pay for the judgment. The second time, you write down what worked. By the tenth time it has a playbook and a price, and a consultant two levels junior can deliver it. That is where the margin lives.
AI deployment follows the same curve. A new use case starts on the most capable model you can get, because nobody yet knows what the task needs. Once the team understands it, the prompts get standardized and an evaluation set appears. Only then can the routine share of the work move to a smaller, cheaper model, with the frontier model kept for the cases that still need judgment. Engineers call this routing and distillation. Services leaders called it leverage and priced it into every proposal.
Watts Humphrey founded the Software Process Program at the Software Engineering Institute. In a 2010 interview, he explained why he went there: “I knew I couldn’t do it alone.” Process work has to outlive any one person. CMMI Level 1 is the stage where it still depends on one. In AI terms, Level 1 is the power user with a personal ChatGPT account and a folder of prompts nobody else has seen. The prompts are the visible part. Underneath sit data only that person knows how to work with and a workflow that lives in their head: which export to pull, and which answers to check twice. The frontier model absorbs that mess the way a senior consultant absorbs a missing process. From the outside, it looks like maturity. It works until that person resigns, and the capability walks out with them.
The five CMMI levels, translated for AI
CMMI for Services defines five maturity levels. Each one maps onto an AI program with almost no translation. (The services model was folded into a single CMMI in 2018, and version 3.0 followed in 2023. The five levels survived both.)
| CMMI level | What CMMI for Services describes | The AI equivalent | Which model does the work |
|---|---|---|---|
| 1 Initial | Ad hoc; success depends on individual heroics | Shadow AI: prompts in one person's head, run on data only they know how to work with | The frontier model, on everything |
| 2 Managed | Work planned and tracked project by project | Approved tools and an AI policy; data sources and workflows written down team by team | The frontier model, now sanctioned |
| 3 Defined | Organization-wide standard processes | Shared prompt libraries and evaluation sets, on governed data with named owners | Routing becomes possible |
| 4 Quantitatively Managed | Processes controlled through measurement | Error rates and cost per task measured, with data quality tracked beside them; escalation thresholds set in advance | Cheaper models on the work you can measure |
| 5 Optimizing | Continuous improvement from causal analysis | Model choices re-tested as prices move; errors fixed at the data source | Whatever meets the error rate at the lowest cost, sometimes the frontier model again |
Two rows matter to a board.
CMMI Level 4 is where the money is, and it is the level most AI programs try to skip. A vendor’s benchmark score is not your error rate. A cheaper model is safe on a task only when someone in your organization has measured how often it fails on your work, and decided in advance what happens when it does. Then they measure again. CMMI assumed a process stays put until you change it; your AI vendor can change the model under you with a silent update or a deprecation notice, and last quarter’s error rate stops describing anything. Downshift without a current number and the cost moves somewhere nobody is looking.
CMMI Level 5 is the punchline. It is also true. Optimizing means re-testing your choices as conditions change. In AI, conditions change every quarter, and sometimes the optimized answer is to send work back up to the model you just moved it off.
Where CMMI for Services needs a patch
CMMI for Services was written for organizations made of people. AI breaks two of its quiet assumptions.
The first: your senior people never get cheaper. An architect’s day rate only moves one direction. The price of model capability moves the other. Epoch AI tracked what it costs to reach a fixed level of model performance. In its March 2025 analysis, that price fell between 9x and 900x a year, depending on the task, and Epoch cautioned that the fastest drops may not last. Even at the slow end of that range, a task you spent January codifying can be beaten in October by a price cut. CMMI never had to plan around a partner whose rate falls by an order of magnitude a year. Your AI program does, so every downshift has to pay back before the frontier gets cheap.
The second: junior people know when they are lost. In my experience, a junior consultant on a mature engagement knows when the playbook has run out. They stop and call the architect. The engagement survives. A model working outside what it was trained for rarely does that, and a small one least of all. It answers anyway, in the same confident tone it uses when it is right.
Cybersecurity learned this in the SOC. Tier-1 analysts and automated playbooks handle the known alerts, and the design holds only because an escalation rule sends the unknown ones to tier 3. The audit question for a SOC is whether the right alerts reached tier 3 in time. CMMI for Services assumed people would escalate on their own. With models, you build the escalation and then measure it. That is the governance work.
What a board should ask about AI maturity
A board gets most of the value of CMMI for Services from three questions to management. No appraisal required. (The appraisal industry is doing fine without you.)
- Which CMMI level is our AI use at, honestly, and who made that call?
- Where are we running cheaper models, and who measured their error rate on our work?
- When a model is out of its depth, what happens next, and who gets called?
Ask the third question first. The answer tells you whether the organization matured or got cheaper.
Downshift before CMMI Level 4 and the savings show up in this quarter’s budget. Next year, the errors show up in front of a customer.
I know the Level 1 argument well. I made it, in public, to Göran Marby. On behalf of my young and naive self, I apologize. Yes, you were right.
I sent him this piece before it went out. He wrote back that there was no need to apologize, and that as he remembers it, the argument was partly about “being able to create transparency for the buyer, which in my world would make the buying decision easier” (translated from Swedish). That is a sharper version of my point than mine. A defined offering with a price is something a buyer can judge. A codified AI process is something a board can judge.
The organizations refusing to codify their AI use today are making the same argument, and they will lose it the way I did. The difference: they won’t get three decades to expand their thinking.
Sources
- CMMI for Services, Version 1.3, Software Engineering Institute, 2010
- CMMI Levels of Capability and Performance, CMMI Institute
- CMMI Institute Expands CMMI V2.0 to Include Services and Supplier Management, ISACA, 4 December 2018 (archived copy)
- CMMI Updates Take Performance Improvements to the Next Level, ISACA Now, 10 April 2023
- CMMI Institute launches CMMI AI Maturity Model, ISACA, 17 July 2026
- Watts Humphrey obituary and 2010 interview quote, SD Times
- LLM inference price trends (March 2025), Epoch AI